Ponder including Cargo.lock in version control and releases

[rgacogne]

Hi!

I was wondering if you ever considered including a Cargo.lock file in your repository and releases? There are pros and cons to doing that, as described in 1, but it helps a lot in getting reproducible builds. It would allow me to move forward with making the Quiche package in Arch Linux 2 reproducible, for example.